{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,18]],"date-time":"2026-06-18T16:19:42Z","timestamp":1781799582927,"version":"3.54.5"},"reference-count":59,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2022,11,29]],"date-time":"2022-11-29T00:00:00Z","timestamp":1669680000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Sen. Netw."],"published-print":{"date-parts":[[2022,11,30]]},"abstract":"<jats:p>We devise new attacks exploiting the unprotected data-plane signaling in cellular IoT networks (a.k.a. both NB-IoT and Cat-M). We show that, despite the deployed security mechanisms on both control-plane signaling and data-plane packet forwarding, novel data-plane signaling attacks are still feasible. The attacker can forge both uplink and downlink data-plane signaling messages that pass the current security checks used by the receiver. With the capability of forging messages, the attacker can launch attacks that exhibit a variety of attack forms beyond simplistic packet-blasting, denial-of-service (DoS) threats, including location privacy breach, packet delivery loop, prolonged data delivery, throughput limiting, radio resource draining, connection reset, and multicast disabling. Our testbed evaluation and operational network validation have confirmed the attack viability. To combat the threat, we further propose a new defense solution within the 3GPP C-IoT standard framework. It leverages the synchronized timer clock information to protect the data-plane signaling messages with low overhead.<\/jats:p>","DOI":"10.1145\/3534124","type":"journal-article","created":{"date-parts":[[2022,5,20]],"date-time":"2022-05-20T12:29:18Z","timestamp":1653049758000},"page":"1-26","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":11,"title":["Breaking Cellular IoT with Forged Data-plane Signaling: Attacks and Countermeasure"],"prefix":"10.1145","volume":"18","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0118-7917","authenticated-orcid":false,"given":"Zhaowei","family":"Tan","sequence":"first","affiliation":[{"name":"University of California, Los Angeles, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1576-261X","authenticated-orcid":false,"given":"Boyan","family":"Ding","sequence":"additional","affiliation":[{"name":"University of California, Los Angeles, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1675-0968","authenticated-orcid":false,"given":"Jinghao","family":"Zhao","sequence":"additional","affiliation":[{"name":"University of California, Los Angeles, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1852-3825","authenticated-orcid":false,"given":"Yunqi","family":"Guo","sequence":"additional","affiliation":[{"name":"University of California, Los Angeles, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3779-0918","authenticated-orcid":false,"given":"Songwu","family":"Lu","sequence":"additional","affiliation":[{"name":"University of California, Los Angeles, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2022,11,29]]},"reference":[{"key":"e_1_3_2_2_2","unstructured":"3GPP. 2017. Proposed way forward on IMT-2020 submission. Retrieved from https:\/\/portal.3gpp.org\/ngppapp\/CreateTDoc.aspx?mode=view&contributionUid=RP-172098."},{"key":"e_1_3_2_3_2","unstructured":"3GPP. 2019. TS36.213: Evolved Universal Terrestrial Radio Access (E-UTRA); Physical layer procedures. Retrieved from https:\/\/www.3gpp.org\/dynareport\/36213.htm."},{"key":"e_1_3_2_4_2","unstructured":"3GPP. 2020. TS33.401: 3GPP System Architecture Evolution (SAE); Security architecture. Retrieved from https:\/\/portal.3gpp.org\/desktopmodules\/Specifications\/SpecificationDetails.aspx?specificationId=2296."},{"key":"e_1_3_2_5_2","unstructured":"3GPP. 2020. TS33.501: Security architecture and procedures for 5G System. Retrieved from https:\/\/portal.3gpp.org\/desktopmodules\/Specifications\/SpecificationDetails.aspx?specificationId=3169."},{"key":"e_1_3_2_6_2","unstructured":"3GPP. 2020. TS33.809: Study on 5G security enhancements against False Base Stations (FBS). Retrieved from https:\/\/portal.3gpp.org\/desktopmodules\/Specifications\/SpecificationDetails.aspx?specificationId=3539."},{"key":"e_1_3_2_7_2","unstructured":"3GPP. 2020. TS33.853: Key issues and potential solutions for integrity protection of the User Plane (UP). Retrieved from https:\/\/portal.3gpp.org\/desktopmodules\/Specifications\/SpecificationDetails.aspx?specificationId=3571."},{"key":"e_1_3_2_8_2","unstructured":"3GPP. 2020. TS36.211: Evolved Universal Terrestrial Radio Access (E-UTRA); Physical channels and modulation. Retrieved from https:\/\/portal.3gpp.org\/desktopmodules\/Specifications\/SpecificationDetails.aspx?specificationId=2425."},{"key":"e_1_3_2_9_2","unstructured":"3GPP. 2021. TS33.401:3GPP System Architecture Evolution (SAE); Security architecture. Retrieved from https:\/\/portal.3gpp.org\/desktopmodules\/Specifications\/SpecificationDetails.aspx?specificationId=2296."},{"key":"e_1_3_2_10_2","unstructured":"3GPP. 2021. TS36.201: Evolved Universal Terrestrial Radio Access (E-UTRA); LTE physical layer; General description. Retrieved from https:\/\/portal.3gpp.org\/desktopmodules\/Specifications\/SpecificationDetails.aspx?specificationId=2424."},{"key":"e_1_3_2_11_2","unstructured":"3GPP. 2021. TS36.212: Evolved Universal Terrestrial Radio Access (E-UTRA); Multiplexing and channel coding. Retrieved from https:\/\/portal.3gpp.org\/desktopmodules\/Specifications\/SpecificationDetails.aspx?specificationId=2426."},{"key":"e_1_3_2_12_2","unstructured":"3GPP. 2021. TS36.321: Evolved Universal Terrestrial Radio Access (E-UTRA); Medium Access Control (MAC) protocol specification. Retrieved from https:\/\/portal.3gpp.org\/desktopmodules\/Specifications\/SpecificationDetails.aspx?specificationId=2437."},{"key":"e_1_3_2_13_2","unstructured":"3GPP. 2021. TS36.322: Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Link Control (RLC) protocol specification. Retrieved from https:\/\/portal.3gpp.org\/desktopmodules\/Specifications\/SpecificationDetails.aspx?specificationId=2438."},{"key":"e_1_3_2_14_2","unstructured":"3GPP. 2021. TS38.211: NR; Physical channels and modulation. Retrieved from https:\/\/portal.3gpp.org\/desktopmodules\/Specifications\/SpecificationDetails.aspx?specificationId=3213."},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.1145\/3300061.3300140"},{"key":"e_1_3_2_16_2","unstructured":"James Blackman. 2020. A 2019 surge a 2020 wobble a 2025 boom\u2014NB-IoT and LTE-M on track says Ericsson. Retrieved from https:\/\/enterpriseiotinsights.com\/20200616\/channels\/news\/nb-iot-and-lte-m-on-track-says-ericsson."},{"key":"e_1_3_2_17_2","unstructured":"Thomas Arthur Herbert Bressner. 2015. Development and Evaluation of UTDoA as a Positioning Method in LTE. Retrieved from https:\/\/www.diva-portal.org\/smash\/get\/diva2:867797\/FULLTEXT01.pdf."},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2018.2846803"},{"key":"e_1_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2019.2931724"},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.micpro.2019.102899"},{"key":"e_1_3_2_21_2","article-title":"CellMapper","year":"2021","unstructured":"CellMapper. 2021. CellMapper. Retrieved from cellmapper.net.","journal-title":"cellmapper.net"},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2019.2957641"},{"key":"e_1_3_2_23_2","doi-asserted-by":"publisher","DOI":"10.1109\/GIOTS.2019.8766430"},{"key":"e_1_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-45719-2_13"},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1145\/3447993.3510589"},{"key":"e_1_3_2_26_2","article-title":"Observed Time Difference Of Arrival (OTDOA) Positioning in 3GPP LTE","author":"Fischer Sven","year":"2014","unstructured":"Sven Fischer. 2014. Observed Time Difference Of Arrival (OTDOA) Positioning in 3GPP LTE. Retrieved from https:\/\/www.qualcomm.com\/media\/documents\/files\/otdoa-positioning-in-3gpp-lte.pdf.","journal-title":"https:\/\/www.qualcomm.com\/media\/documents\/files\/otdoa-positioning-in-3gpp-lte.pdf"},{"key":"e_1_3_2_27_2","doi-asserted-by":"publisher","DOI":"10.1145\/2980159.2980163"},{"key":"e_1_3_2_28_2","unstructured":"GSMA. 2021. Mobile IoT LPWA - LTE-M & NB-IoT Commercial Launches: GSMA. Retrieved from https:\/\/www.gsma.com\/iot\/mobile-iot-commercial-launches."},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1109\/CNS53000.2021.9705028"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCN49398.2020.9209689"},{"key":"e_1_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2017.2786680"},{"key":"e_1_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.1109\/IFIPNetworking.2016.7497239"},{"key":"e_1_3_2_33_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23313"},{"key":"e_1_3_2_34_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23442"},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00051"},{"key":"e_1_3_2_36_2","doi-asserted-by":"publisher","DOI":"10.1145\/3317549.3323416"},{"key":"e_1_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.1145\/2973750.2973751"},{"key":"e_1_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2016.7452266"},{"key":"e_1_3_2_39_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2019.2904799"},{"key":"e_1_3_2_40_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2020.3013949"},{"key":"e_1_3_2_41_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-65127-9_19"},{"key":"e_1_3_2_42_2","unstructured":"Positive Technologies. 2018. Diameter Vulnerabilities Exposure Report. Retrieved from https:\/\/www.gsma.com\/membership\/wp-content\/uploads\/2018\/09\/Diameter-2018-eng.pdf."},{"key":"e_1_3_2_43_2","volume-title":"Proceedings of the 10th USENIX Workshop on Offensive Technologies (WOOT\u201916)","author":"Rupprecht David","year":"2016","unstructured":"David Rupprecht, Kai Jansen, and Christina P\u00f6pper. 2016. Putting LTE security functions to the test: A framework to evaluate implementation correctness. In Proceedings of the 10th USENIX Workshop on Offensive Technologies (WOOT\u201916)."},{"key":"e_1_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00006"},{"key":"e_1_3_2_45_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24283"},{"key":"e_1_3_2_46_2","unstructured":"Rhode & Schwarz. 2013. LTE: System Specifications and Their Impact on RF & Base Band Circuits. Retrieved from https:\/\/cdn.rohde-schwarz.com\/pws\/dl_downloads\/dl_application\/application_notes\/1ma221\/1MA221_0e.pdf."},{"key":"e_1_3_2_47_2","article-title":"Practical attacks against privacy and availability in 4G\/LTE mobile communication systems","author":"Shaik Altaf","year":"2015","unstructured":"Altaf Shaik, Ravishankar Borgaonkar, N. Asokan, Valtteri Niemi, and Jean-Pierre Seifert. 2015. Practical attacks against privacy and availability in 4G\/LTE mobile communication systems. In Proceedings of the Network and Distributed Systems Security Symposium.","journal-title":"I"},{"key":"e_1_3_2_48_2","doi-asserted-by":"publisher","DOI":"10.1145\/3212480.3212497"},{"key":"e_1_3_2_49_2","doi-asserted-by":"publisher","DOI":"10.1145\/3317549.3319728"},{"key":"e_1_3_2_50_2","unstructured":"STMicroelectronics. 2021. LTE Cellular to Cloud Pack with STM32L496AG MCU. Retrieved from https:\/\/www.st.com\/en\/evaluation-tools\/p-l496g-cell02.html."},{"key":"e_1_3_2_51_2","unstructured":"sysmocom. 2016. sysmoUSIM-SJS1 SIM + USIM Card (10-pack). Retrieved from http:\/\/shop.sysmocom.de\/products\/sysmousim-sjs1."},{"key":"e_1_3_2_52_2","doi-asserted-by":"publisher","DOI":"10.1145\/3447993.3483255"},{"key":"e_1_3_2_53_2","volume-title":"Proceedings of the USENIX Symposium on Networked Systems Design and Implementation (NSDI)","author":"Tan Zhaowei","year":"2021","unstructured":"Zhaowei Tan, Jinghao Zhao, Yuanjie Li, Yifei Xu, and Songwu Lu. 2021. Device-based LTE latency reduction at the application layer. In Proceedings of the USENIX Symposium on Networked Systems Design and Implementation (NSDI)."},{"key":"e_1_3_2_54_2","unstructured":"ublox. 2020. Even with 5G on the horizon 4G LTE-M and NB-IoT devices show no signs of going obsolete. Retrieved from https:\/\/www.u-blox.com\/en\/blogs\/insights\/even-5g-horizon-4g-lte-m-and-nb-iot-devices-show-no-signs-going-obsolete."},{"key":"e_1_3_2_55_2","doi-asserted-by":"publisher","DOI":"10.1145\/3447993.3483239"},{"key":"e_1_3_2_56_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2018.8422191"},{"key":"e_1_3_2_57_2","article-title":"How can IoT services pose new security threats in operational cellular networks?","author":"Xie Tian","year":"2020","unstructured":"Tian Xie, Guan-Hua Tu, Chi-Yu Li, and Chunyi Peng. 2020. How can IoT services pose new security threats in operational cellular networks?IEEE Trans. Mob. Comput. 20, 8 (2020).","journal-title":"IEEE Trans. Mob. Comput."},{"key":"e_1_3_2_58_2","doi-asserted-by":"publisher","DOI":"10.1145\/3372224.3419212"},{"key":"e_1_3_2_59_2","first-page":"55","volume-title":"Proceedings of the 28th USENIX Security Symposium (USENIX Security\u201919)","author":"Yang Hojoon","year":"2019","unstructured":"Hojoon Yang, Sangwook Bae, Mincheol Son, Hongil Kim, Song Min Kim, and Yongdae Kim. 2019. Hiding in plain signal: Physical signal overshadowing attack on LTE. In Proceedings of the 28th USENIX Security Symposium (USENIX Security\u201919). 55\u201372."},{"key":"e_1_3_2_60_2","doi-asserted-by":"publisher","DOI":"10.1145\/3447993.3483254"}],"container-title":["ACM Transactions on Sensor Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3534124","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3534124","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T19:00:09Z","timestamp":1750186809000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3534124"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,11,29]]},"references-count":59,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2022,11,30]]}},"alternative-id":["10.1145\/3534124"],"URL":"https:\/\/doi.org\/10.1145\/3534124","relation":{},"ISSN":["1550-4859","1550-4867"],"issn-type":[{"value":"1550-4859","type":"print"},{"value":"1550-4867","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,11,29]]},"assertion":[{"value":"2022-02-25","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-04-27","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-11-29","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}